RE: [cobalt-security] Qubes - hacked

["Randy Russell" <rrussell@xxxxxxxxxxxxxx>]

I just restored a Qube 3 with OSRCD standard. Start up the wizard and
installed the first patch 2 patches:
Sun Cobalt System Update 1.0
Qube3-All-Security-2.0.1-13453

I am getting this msg in a telnet session:

login: admin
Password:
You have mail.
[admin admin]$ mail
BUG IN DYNAMIC LINKER ld.so: dynamic-link.h: 57: elf_get_dynamic_info:
Assertion
 `! "bad dynamic tag"' failed!
[admin admin]$


What's going on?

-Randy

-----Original Message-----
From: cobalt-security-admin@xxxxxxxxxxxxxxx
[mailto:cobalt-security-admin@xxxxxxxxxxxxxxx]On Behalf Of Michael
Stauber
Sent: Wednesday, April 30, 2003 4:45 PM
To: cobalt-security@xxxxxxxxxxxxxxx
Subject: Re: [cobalt-security] Qubes - hacked


Hi Randy,

> I was in the same boat when one after another of my client's Qube3 was
> starting having problem It was the week before Easter and on. It was very
> stressful. One of the hack Qube3 was missing the Smb files.

The Samba on a fully patched Qube3 is samba-2.2.2-C1 and Squid is
squid-2.4.STABLE6-C1Q3. I'm not sure which patches were backported, but I
have the nagging feeling that either an enabled Samba or Squid server could
be the culprit.

I have a couple of Qube3's behind a dedicated firewall and only allow web,
email and SSH traffic from the outside and haven't had any problems - even
though one of the boxes is awfully behind on patches.

> I love the Blue Box because it's a great solution for SOHO.

It sure is. A more modern Qube is pretty high on my wish-list. Larger disks,
2.4 Kernel and stuff like a built in PDF-Printer (through Samba and
Ghostscript) and a better built in firewall <sigh>.

--

With best regards,

Michael Stauber

_______________________________________________
cobalt-security mailing list
cobalt-security@xxxxxxxxxxxxxxx
http://list.cobalt.com/mailman/listinfo/cobalt-security